API Keys

An API key is a credential that lets code — a script, app, or automated pipeline you build — authenticate to the platform's API instead of you signing in through a browser each time. Each key can be scoped to only the parts of the API it needs, similar to giving a contractor a keycard that opens some doors but not others.

Each API key carries its own set of scopes — the specific API operations it's allowed to call — which can be chosen from predefined scope bundles or adjusted after the key is created. Keys can also be given a per-minute rate limit and an expiration date, and can be deactivated at any time. For security, the full key value is shown only once, at creation: the platform stores an HMAC-SHA256 hash of it rather than the key itself, retaining only a short prefix so the key can still be recognized later in a list. If a key is lost or a rotation is needed, the practice is to create a new key with the required scopes and then deactivate the old one, rather than trying to recover the original value. Usage is tracked — last-used time, last-used IP address, and a running usage count — so unexpected activity on a key can be noticed.